CVE-2026-89586 - Vulnerability Details

- ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes

Description

In the Linux kernel, the following vulnerability has been resolved:

ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes

ata_scsi_write_same_xlat() translates a SCSI WRITE SAME command with the
UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM
descriptor is built by ata_format_dsm_trim_descr() into the 2048-byte
ata_scsi_rbuf staging buffer, and the number of bytes copied is compared
against the logical sector size by the caller:

size = ata_format_dsm_trim_descr(scmd, trmax, block, n_block);
if (size != len) /* len == sdp->sector_size */
goto invalid_param_len;

ata_format_dsm_trim_descr() clamps the copy length to ATA_SCSI_RBUF_SIZE
(2048). On a device whose logical sector size exceeds that (e.g. a 4Kn
device, where sector_size == 4096) the function can never return more than
2048, while the caller expects it to return sector_size. The comparison
therefore always fails, so every TRIM is rejected with "Parameter list
length error" and WARN_ON() splats on each attempt. TRIM / discard is
thus completely broken on such devices.

The descriptor was incorrectly sized from the logical sector size. A DSM
TRIM payload is a list of 512-byte pages, each holding up to
ATA_MAX_TRIM_RNUM (64) LBA Range Entries, and is independent of the logical
sector size. The Block Limits VPD page already advertises a single such
page as the maximum WRITE SAME length (65535 * ATA_MAX_TRIM_RNUM logical
blocks), so the block layer never sends a request that needs more than one
page.

Emit exactly one 512-byte page, independent of the logical sector size,
and transfer only that page (COUNT == 1). For a 512-byte-sector device
this is unchanged; devices with larger logical sectors now work instead of
failing every TRIM.

Published: 2026-09-11

Score: 4.4 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A logic error in libata-scsi caused the kernel to truncate the TRIM descriptor to 2048 bytes. The descriptor length is then compared to the device’s logical sector size. For devices with sector sizes larger than 2048 bytes, such as 4096, the comparison fails, resulting in every TRIM request being rejected with a parameter‑length error. This disables discard for the device, degrading storage performance and preventing the kernel from freeing unused blocks.

Affected Systems

Linux kernel builds that include libata-scsi support are affected when used with block devices whose logical sector size exceeds 2048 bytes, such as 4096‑byte 4Kn SSDs. All unpatched potentially impacted systems exhibit broken TRIM functionality for those devices.

Risk and Exploitability

The flaw leads to denial of service rather than remote code execution. With a CVSS score of 4.4, an EPSS score of less than 1%, and no listing in the CISA KEV catalog, the likelihood of active exploitation is low. Based on the description, it is inferred that an attacker would need local or administrative access to issue TRIM commands, making the risk primarily for systems that automatically trigger discard operations.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff`	affected	< 04e2befe25792f2e90097f284d7e86fc6bcfe928
`ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff`	affected	< c2e3dccd6870659851eaa4c12ab16418b8e3040a
`ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff`	affected	< 4a4268a0b0a595bd9534cf9c7fda93775a7d8a0d
`ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff`	affected	< 79cce911e623c0baa0fde307ce3a434e084b881a

Linux

affected

Version	Status	Constraints
`4.9`	affected	—
`0`	unaffected	< 4.9
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that includes the libata-scsi TRIM bug fix.
If a kernel upgrade cannot be performed immediately, disable discard on the affected devices—for example, remove the discard option from filesystem mount entries or set discard=no in udev rules for the block device.
Rebuild the kernel after applying a vendor patch into the kernel source tree.

Generated by OpenCVE AI on September 12, 2026 at 17:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/04e2befe25792f2e90097f284d7e86fc6bcfe928
https://git.kernel.org/stable/c/4a4268a0b0a595bd9534cf9c7fda93775a7d8a0d
https://git.kernel.org/stable/c/79cce911e623c0baa0fde307ce3a434e084b881a
https://git.kernel.org/stable/c/c2e3dccd6870659851eaa4c12ab16418b8e3040a
https://nvd.nist.gov/vuln/detail/CVE-2026-89586
https://www.cve.org/CVERecord?id=CVE-2026-89586

History

Sat, 12 Sep 2026 17:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-130
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89586 https://www.cve.org/CVERecord?id=CVE-2026-89586
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 12 Sep 2026 09:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes ata_scsi_write_same_xlat() translates a SCSI WRITE SAME command with the UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM descriptor is built by ata_format_dsm_trim_descr() into the 2048-byte ata_scsi_rbuf staging buffer, and the number of bytes copied is compared against the logical sector size by the caller: size = ata_format_dsm_trim_descr(scmd, trmax, block, n_block); if (size != len) /* len == sdp->sector_size / goto invalid_param_len; ata_format_dsm_trim_descr() clamps the copy length to ATA_SCSI_RBUF_SIZE (2048). On a device whose logical sector size exceeds that (e.g. a 4Kn device, where sector_size == 4096) the function can never return more than 2048, while the caller expects it to return sector_size. The comparison therefore always fails, so every TRIM is rejected with "Parameter list length error" and WARN_ON() splats on each attempt. TRIM / discard is thus completely broken on such devices. The descriptor was incorrectly sized from the logical sector size. A DSM TRIM payload is a list of 512-byte pages, each holding up to ATA_MAX_TRIM_RNUM (64) LBA Range Entries, and is independent of the logical sector size. The Block Limits VPD page already advertises a single such page as the maximum WRITE SAME length (65535 ATA_MAX_TRIM_RNUM logical blocks), so the block layer never sends a request that needs more than one page. Emit exactly one 512-byte page, independent of the logical sector size, and transfer only that page (COUNT == 1). For a 512-byte-sector device this is unchanged; devices with larger logical sectors now work instead of failing every TRIM.
Title		ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/04e2befe25792f2e90097f284d7e86fc6bcfe928 https://git.kernel.org/stable/c/4a4268a0b0a595bd9534cf9c7fda93775a7d8a0d https://git.kernel.org/stable/c/79cce911e623c0baa0fde307ce3a434e084b881a https://git.kernel.org/stable/c/c2e3dccd6870659851eaa4c12ab16418b8e3040a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:44:51.322Z

Updated: 2026-09-11T19:44:51.322Z

Reserved: 2026-09-11T19:38:34.729Z

Link: CVE-2026-89586

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:43.040

Modified: 2026-09-11T20:19:43.040

Link: CVE-2026-89586

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:44:51Z

Links: CVE-2026-89586 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-12T17:30:16Z

Weaknesses

CWE-130
Improper Handling of Length Parameter Inconsistency

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object